Security Awareness: Asking the Right Questions to Protect Information Keith A. Watson, CISSP Research Engineer Center for Education and Research and Information Assurance and Security

Overview A Brief Intro to Information Security Responsibility Knowledge Contacts

A Brief Intro to Information Security Information Security is the Process of Protecting Information and Information Resources

Information Security Intro Information assets are the most critical and most valuable Applies to information in electronic and physical forms Three primary goals Confidentiality Integrity Availability

Information Security Examples (Confidentiality) What would happen if sample information were accidentally published to web site? (Integrity) How reliable would sample information be if it could be modified by anyone on the network? (Availability) How would you get any work done if all the mice disappeared?

Responsibility Who? Why?

Who is Responsible? Are you responsible for the security of your system? Is the system administrator responsible? Do you have the administrator password for your system?

Answers You Might Not Like You are at least partly responsible for the security of the information on the system. The system administrator might be responsible for the security of the system. If you have the administrator password, then you are probably responsible for everything.

But wait, I’m not an admin… Find someone else to be in charge of the security of the system Someone who will take an active part in managing the system Give up your admin password and live the life of a lowly user

Why am I in charge? You have no system admin Policy puts you in charge No budget for one Can’t find one (industry pays better) You have one, but he can’t be trusted Policy puts you in charge You create it, you manage it (functional data owner policy) Decentralized control You manage the system. The admin answers your questions.

Knowledge What? How?

The Bare Minimum Update that System! Back it Up! Worms, Viruses, Spyware, Oh My! *#@^%$&! Shields Up!

Update that System! Is your system up to date? Windows (and Mac) Linux Run software update tools at least on the second Tuesday of the month (Windows patch release day) Turn on auto updates (catch off-cycle patches) Linux Check for updates at least weekly (yum, RHN, etc) If you don’t manage updates, make sure your admin follows these guidelines

Back it Up! Back up strategy: Methods: Critical/Important data daily Systems at least weekly Methods: External drives (USB/Firewire) Tapes Servers

Worms, Viruses, Spyware, Oh My! You should have anti-virus/spyware software installed and updating daily Scan every Attachment File downloaded If you didn’t install and configure the anti-virus/spyware software, find out who did Make sure it is enabled and auto updating

*#@^%$&! Strong Passwords We have too many passwords to remember The “Music Method’: Chose the words from a song: “Mary had a little lamb whose fleece was…” Select the first letters of the words: “M h a l l w f w” Change some of the letters to numbers: “M4a1lwfw” Change some letters to upper case: “M4A1lWfw”

*#@^%$&! Stronger Passwords We have too many systems to use The “Variations on a Theme” Method: Using your MM password, modify the trailing characters for different systems: “M4A1lWnP” ==> network password “M4A1lWw5” ==> web site password “M4A1lWSv” ==> server password

Shields Up! Screen Locks On Enable screensavers with passwords Lock the screen when you step away Use an idle timeout to auto lock it 10 minutes is probably good enough

Shields Up! Firewalls Software On Desktop firewall software prevents some network-based inbound attacks Some limit outbound connections as well Modern operating systems have a firewall Turn it on Enable/Allow the net services that you use

Shields Up! “Unnecessary Stuff” Off Remove unneeded software Fewer vulnerabilities to worry about Save some disk space too Turn off unnecessary services Fewer ways an attacker can get to you Improve performance too

Some Extra Stuff Above the Bare Minimum Encrypt that Data! Lock that Door, Desk, and Cabinet! Glue that Computer Down!

Encrypt that Data! Disk encryption Email encryption Stolen hardware has interesting info on it Windows XP EFS Mac OS X FileVault PGP Disk Email encryption Email is like a postcard, anyone can read it PGP or GPG S/MIME (most modern mail tools support it)

Lock that Door, Desk, and Cabinet! Better Physical Security needed Have rules about locking labs and offices Move your sensitive paperwork into file cabinets before you go home Lock up your expensive gizmos in a desk

Glue that Computer Down! Computers are getting smaller and sprouting legs Laptops Get a cable lock Use it at the office and when you travel Desktops Get a steel cage lock box or cable kit Two-sided carpet tape works too!

Contacts Who? Why?

Who do I contact? If a law has been broken, call the police Ask for an officer responsible for computer crimes They may refer you to other agencies (FBI, Secret Service, state police, etc.) Be aware that they may take your system away for analysis

Who do I contact? If there is a problem with your system, unplug it from the network Do NOT turn it off! Call the admin and/or your local security person

Contact Pitfalls No one knows what to do No one wants to do anything Next steps (before you plug it into the network): Reinstall system from original media (update) Configure security options (FW, AV/S, etc) Restore user/project data from backup

Summary Information is critical to the mission of the NPDN Determine responsibility for security. Improve the security of your systems. Find out what to do when things go wrong.